AVAILABILITY ZONES GATEWAY CONVERSION

I would go into further detail on Availability Zones in the upcoming postings, as I promised. You should definitely employ availability zones if your Azure region allows them. Although there is a slight increase in cost for the services, you can use an active-active infrastructure and receive a greater SLA.

The VPN/ER Gateways are typically where this active-active system begins. There are basically three ways to deploy an Azure Gateway: zonal (where you choose the zone in which it will be placed), redundancy (where it will be deployed in at least two zones), and regional (which means it can go in any AZ, you just don't know which).

Current Gateways
However, what happens if you wish to change your current virtual network gateway into a redundant or zonal gateway? Unfortunately, there isn't a simple solution to convert without experiencing any downtime. The old GW must be deleted, and a new one must be deployed. In addition, new IP addresses, connections must be cleared, tags must be set, and other configurations must be restored. If only this could be done for you by a script.

Script for Gateway Conversion
A script called ConvertGatewayToAZ.ps1 uses an already-existing Gateway as input. It creates a new zonal or zone redundant gateway and copies and exports the configuration, allowing you to recover if necessary. The connections, BGP settings, and Tags are all set up the same on the new gateway. Both active/passive and active/active deployments can use this script. A gateway can also be moved between zones or from Zonal to ZoneRedundant.

In order to accomplish this, the script creates new Public IP addresses by appending _REDUNDANT to the existing IP address name. It also uses the prior Public IP setup, which includes DNS name and tags.

It should be noted that you will need to replace your on-premises VPN equipment when new Public IP addresses are assigned; the script will alert you to this. While new gateways are deployed and old ones are deleted, running the script is simple but does take some time. A maximum of 1.5 hours is feasible due to the 45-minute time limit for both creation and deletion. But I'm typically done with my exams in around fifteen minutes.

The script always exports the JSON configuration of every item that is going to be removed in case something goes wrong, allowing you to manually recover these objects. To accomplish this, simply launch a fresh ResourceGroup Deployment:

The exported files are available for:

The old gateway
The connections
Public IP address (although this is not deleted)

The sole degree of upgrade for the gates is AZ. This implies that you will be updated to VPNGW2AZ if you currently own a Generation 1 VPNGW2. Should you continue to use a Basic SKU, the script will upgrade it to at least VpnGw1AZ. The gateway won't be upgraded if it is currently an AZ-based GW. 

Please take note that the gateway upgrade will cost extra.